Five typosquat crates plus compromised arrayref/internment versions deleted after build-script payload injection; 86–107 minute exposure window.
Summary
If your Cargo.lock pulled append-only-vec@0.1.9, arrayref@0.3.10, or internment@0.8.7 between 2026-08-20 07:15–09:25 UTC, you downloaded malicious binaries. Scanning local cache is mandatory; credential compromise on arrayref maintainer signals ongoing registry risk.
Why it matters
If your Cargo.lock pulled append-only-vec@0.1.9, arrayref@0.3.10, or internment@0.8.7 between 2026-08-20 07:15–09:25 UTC, you downloaded malicious binaries. Scanning local cache is mandatory; credential compromise on arrayref maintainer signals ongoing registry risk.
Implementation verdict
Run the provided `find` command against ~/.cargo/registry/cache immediately to detect affected crate files. No mitigation exists for already-built artifacts—rebuild and redeploy if positives found. Downgrade to pre-malicious versions (arrayref <0.3.10, internment <0.8.7, append-only-vec <0.1.9) and audit build logs for the exposure window.
Sources
Dev Signal
Get briefs like this in your inbox — free, every weekday.
100+ sources compressed into one 4-minute read. Ranked, cited, implementation-ready.